Build a secure agent

Give each AI agent its protection in one place. Choose who uses it, its tools and models, a protection level and its governance, review the effect and the policy engine test, then publish. Every publication is a version you can restore, and an agent can be paused at once.

Secure Agents in WASViking^® AI Guardian puts everything that protects one AI agent on one screen: who uses it, the tools it gets through the MCP Gateway, the models it calls through the AI Gateway, the controls on every call and its record in AI Governance. You change it in a draft, see the effect in plain words and the decision of the real policy engine, and publish when it is right.

An agent here is not a new kind of object. Publishing writes the same things you can already configure by hand: an MCP gateway, a toolkit, an AI Gateway workload, AI Guardian policy rules and an AI Governance use case. They stay visible in their own screens, so nothing is hidden and nothing you configured before changes.

Before you start

• Secure Agents needs the AI Gateway or the MCP Gateway in your contract (both are add-ons from the Pro plan). Published agents are included per plan: 3 on Pro, 10 on Business and 25 on Enterprise.
• To create and edit drafts you need an administrator role, or a role with AI Gateway manage access.
• To publish, pause or archive an agent you need an administrator role, or a role with manage access to AI Gateway, AI Guardian policies and AI Governance together, because a publication changes all three.
• Each module the agent uses must be part of your contract and then turned on: the MCP Gateway for an agent with tools, and the AI Gateway (with a provider credential) for an agent with models. Your partner or WASViking sales adds a module that is not in your contract.
• The tools you want must be approved in MCP Gateway first. Only approved, clean tools are ever offered.

Step 1: start an agent

Open AI Guard > Protection > Secure Agents and pick a starting point:

Everything can be changed before the first publication. You can also start from an agent WASViking found: in AI Agents, open it and click Protect this agent. The draft takes its name and owner, and the use case is linked to it.

Step 2: shape the agent on the canvas

The agent page shows the agent in the middle and its blocks around it. Click a block to open its panel, then Save to draft. Nothing reaches your gateways until you publish.

The protection levels:

Every level also withholds tool results with hidden instructions and masks secrets in results; Production protected masks personal data too. With Custom, a choice that lets changes or destructive tools run without anyone's approval needs your explicit confirmation in the panel.

Get it ready for people

At the top of the Design tab, the Before people can use it card lists what is still missing and puts the fix next to each item:

When everything is in place the card reads Ready for people.

To review a tool, click Review next to it in the What this agent offers table, or click a tool listed as not offered. You see its description, any scanner findings, what changed since it was last approved and what it does. Approve (or Accept findings and approve, with a note), Save what it does to classify it again, or Quarantine. Approving a tool makes it usable wherever it is offered in your organization, not only in this agent.

Step 3: review and publish

Click Review and publish. The review shows:

• What changes, in plain sentences: who gains or loses the agent, the tools it starts or stops offering, the protection, models, budget and governance.
• Before publishing: anything that blocks the publication, such as a missing owner, nothing to offer, models without a route, or a test failure.
• Worth a look: for example nobody can use the agent yet, a tool waits for review, or a toolkit made for every gateway also applies to this agent.
• Policy engine test: the real AI Guardian policy engine decides probe calls (a change on a known target, on an unknown one, on a high-risk one, a destructive tool, a result with hidden instructions, a result with a secret) and each of the agent's tools, with the new rules and every other rule of your organization. A decision weaker than the protection promises blocks the publication; a stronger one, from another rule of yours, is shown as such.

Add a note if you like and click Publish. The agent is live at once.

Step 4: connect clients and automations

Open the Access tab:

• Connect an AI client: copy the endpoint or the ready line for Claude Code or Cursor. People sign in with their WASViking account and see only this agent's tools.
• Keys for automations: click Create a key for a pipeline or a service. The key gets the agent's tools at once. Copy it when it is shown; WASViking keeps only a hash. Keys expire after 90 days and can be revoked here.
• Models: when the agent has models, copy the base URL for your model SDK and create a model key.
• See what a person gets: pick a person and click Show. The gateway answers with the tools that person gets from the published agent and why the others are left out (not given, waiting for review, not allowed by the protection, needs their own sign-in to the server).

Watch what the agent does

The Activity tab shows the agent's tool calls in the last 30 days, the calls that were refused, what waits for approval, results that were masked or withheld, its model spend against the budget and the health of the servers it uses. Requests waiting for a person are listed under Approvals: click Approve, or Deny with a reason. Nobody decides their own request. They also appear in Approvals & Exceptions, with every other gateway's.

Change it safely

• Draft: every edit stays in the draft until you publish. Discard changes brings the draft back to the published version.
• History: every publication is kept with its effect and who published it. Load into draft brings an earlier version back for review and publication.
• Pause: disables the agent's gateways at once; every call answers that the gateway is disabled. Resume turns them back on.
• Archive: pauses the agent and turns its policy rules off. Restore brings it back paused.
• Second approval: in the Agent block, turn on Second approval and every publication waits for another administrator, who approves or rejects it on the agent page. Only an organization administrator can turn it off.

Changed outside the builder

The objects an agent owns remain ordinary objects. If someone edits the agent's toolkit, gateway, use case or one of its rules in another screen, the agent page marks the block Changed outside and says what changed. The next publication puts the agent's version back only after you confirm it in the review.

Usage and limits

Published agents count against the allowance in your contract: 3 are included on Pro, 10 on Business and 25 on Enterprise. A paused agent still counts; drafts and archived agents do not, and publishing a new version of an agent that is already published does not use another place.

• Publishing above the allowance is refused with "Your contract allows N published agents. Archive an agent you no longer use, or ask your WASViking partner or WASViking for more." The same check applies when a second approval is given.
• A panel under the header of the Secure Agents screen shows the published agents against the allowance, and the AI Guardian tab of Profile & Plan Usage has the same numbers in one card per module.
• The agent's tool calls and model requests count in the usage of the MCP Gateway and the AI Gateway. When one of them holds new keys after 30 days above its contract, keys created on the Access tab wait too. Existing keys keep working and nothing is billed automatically.

Your WASViking partner raises the allowance, or WASViking sales if you buy directly. If your organization received Secure Agents as a 60-day trial when the modules were packaged, the panel also shows the date the trial ends.

Troubleshooting

What next

• Approve the tools your agents need in the MCP Gateway.
• Add provider credentials and routes in the AI Gateway before giving an agent models.
• Subscribe a channel to AI Guardian Approval Requested so the people who approve changes hear about them.